CVE-2026-15414: WooCommerce Privilege Escalation Flaw

CVE-2026-15414 Overview

CVE-2026-15414 is a Privilege Escalation vulnerability [CWE-269] in the Subscriptions for WooCommerce plugin for WordPress, affecting versions up to and including 2.0.0. The flaw resides in the save_meta_boxes() function, which persists the _wps_plan_user_role membership plan meta from $_POST without an allowlist that excludes privileged roles. Authenticated users with Contributor-level access or higher can store 'administrator' as the role granted at membership acquisition. When the Subscriptions for WooCommerce Pro companion plugin processes membership lifecycle events, it applies the attacker-chosen role via add_role(), elevating the account to Administrator.

Critical Impact
Contributor-level accounts can escalate to Administrator, achieving full site takeover on WordPress instances running both the base plugin (≤ 2.0.0) and the Pro companion plugin.

Affected Products

Subscriptions for WooCommerce plugin for WordPress, versions up to and including 2.0.0
Subscriptions for WooCommerce Pro companion plugin (required for exploitation)
WordPress sites exposing wps_membership_plan custom post type editing to Contributor+ roles

Discovery Timeline

2026-08-01 - CVE-2026-15414 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15414

Vulnerability Analysis

The vulnerability exists in the save_meta_boxes() handler within class-wps-membership-plan-cpt.php. When a membership plan is saved, the handler reads the _wps_plan_user_role value directly from the $_POST array. The only validations applied are sanitize_key() and wp_roles()->is_role(). Both functions accept 'administrator' as a legitimate value, so neither blocks assignment of a privileged role.

The administrative UI renders the role dropdown with a disabled attribute intended to prevent selection of privileged roles. This is a client-side-only control. An attacker bypasses it by editing the DOM in browser DevTools or by issuing a crafted POST request directly to the save endpoint.

The stored meta value is later consumed by the Pro companion plugin, which calls add_role() on the acquiring user during membership lifecycle events. This step converts the stored string into an actual role assignment on the target account.

Root Cause

Two design defects combine to create the privilege escalation path. First, the wps_membership_plan custom post type is registered with capability_type => 'post', so the current_user_can('edit_post', $post_id) guard in save_meta_boxes() is satisfied by any user with the edit_posts capability, including Contributors. Second, the input validation on _wps_plan_user_role lacks an allowlist that excludes administrator and other privileged roles.

Attack Vector

An authenticated attacker with at least Contributor privileges accesses the membership plan edit screen or sends a direct POST request to the plan save endpoint. The attacker submits _wps_plan_user_role=administrator alongside valid plan fields. WordPress persists the value as post meta. When the attacker (or another account they control) subsequently acquires the manipulated membership plan, the Pro companion plugin invokes add_role('administrator') on that user via get_post_meta() lookup during the lifecycle event, granting full administrative access.

Review the vulnerable code paths in the Plan Details meta box and the Membership Plan CPT save handler for technical details.

Detection Methods for CVE-2026-15414

Indicators of Compromise

Unexpected _wps_plan_user_role post meta values equal to administrator or other privileged roles on wps_membership_plan post types.
Recent role changes on user accounts previously assigned Contributor, Author, or Editor roles, especially accounts that acquired a membership plan.
POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php referencing wps_membership_plan originating from low-privilege sessions.
New Administrator accounts created shortly after membership plan edits by non-admin users.

Detection Strategies

Query the wp_postmeta table for rows where meta_key = '_wps_plan_user_role' and meta_value matches privileged roles (administrator, editor, or custom high-privilege roles).
Audit WordPress user role transitions using the set_user_role action hook or user meta history logs.
Correlate membership plan save events with the acting user's role — Contributor-authored plans with elevated role meta warrant investigation.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with rules that inspect _wps_plan_user_role parameter values in POST bodies to wps_membership_plan endpoints.
Alert on any invocation of add_role() for privileged roles outside expected administrative workflows.
Retain WordPress admin action logs and web server access logs to reconstruct the sequence between plan edits and role changes.

How to Mitigate CVE-2026-15414

Immediate Actions Required

Update the Subscriptions for WooCommerce plugin to a version later than 2.0.0 once released by the vendor.
Audit all wps_membership_plan posts for stored _wps_plan_user_role values matching privileged roles and reset them to a safe default such as customer or subscriber.
Review all user accounts for unauthorized role elevation and revoke Administrator privileges from any account that should not hold them.
Restrict Contributor and above account creation until the patch is applied; rotate credentials for any suspected compromised account.

Patch Information

The vendor addressed the issue in the changeset published on the WordPress plugin repository. Review the fix details in the WordPress plugin change set and the Wordfence vulnerability analysis. Apply the patched release across all environments running the plugin.

Workarounds

Deactivate the Subscriptions for WooCommerce Pro companion plugin until the base plugin is patched; without it, the stored role meta is not applied via add_role().
Temporarily remove edit_posts capability from Contributor and Author roles, or restrict access to the wps_membership_plan post type through a capability manager plugin.
Deploy WAF rules that reject POST requests containing _wps_plan_user_role=administrator or other privileged role values.

bash

# Example: audit stored membership plan roles via WP-CLI
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = '_wps_plan_user_role' \
  AND meta_value IN ('administrator','editor');"

# Reset any privileged values to a safe default
wp db query "UPDATE wp_postmeta SET meta_value = 'customer' \
  WHERE meta_key = '_wps_plan_user_role' \
  AND meta_value = 'administrator';"